5

**please note, I've changed the question in response to the suspicion that this site is dubious.*

I found this today - https://www.testexchangeconnectivity.com/

Pretty nifty! (or maybe not?)

There's a post about this site on a site called msexchangeteam.com.

They claim to be the "official blog of the Microsoft Exchange Team".

There's also a facebook group for this tool here.

I used the testexchangeconnectivity tool today - perhaps this was foolish.

HopelessN00b
  • 53,954
chickeninabiscuit
  • 1,104
  • I vote to close this. At the very least that site is a bit suspect. – John Gardeniers Jul 16 '09 at 02:19
  • @John Gardeniers - Although it appears suspicious at first, all official tools point to this being a legitimate site (such as whois listing Microsoft as the registering party). – DWilliams Jul 16 '09 at 02:27
  • Indeed. DNS hosted by msft.net, and google doesn't know many places that do link to this site, let alone reputable ones. – jldugger Jul 16 '09 at 02:27
  • http://msexchangeteam.com/archive/2009/03/25/450908.aspx

    Does MS not understand the implications of handing out authentication? Sometimes, there's a reason to write a windows app over a webapp.

     – jldugger Jul 16 '09 at 02:31
  • As mhud said, I think you may have dodged a bullet. It looks like it is a legit Microsoft tool, but very badly branded and presented. I think this could be a lesson to everyone though, because a smart phisher could do something very similar. – Mark Henderson Jul 16 '09 at 04:51

5 Answers5

3

As the updated question says, there's a post about this on "You had me at EHLO," so I guess it's official:

Announcing the release of Exchange Server Remote Connectivity Analyzer

CC.
  • 131
2

Ummm, are you 100% sure? I'm not sure if I'm going to be giving out my entire exchange username and password that it asks for. Maybe I'm paranoid but I don't 100% trust it.

Mark Henderson
  • 69,083
  • Yeah, it seems a little fishy to me. I don't see anything on that site that makes me confident that it is indeed Microsoft doing this. It seems like if they wanted users to trust that their credentials were safe they would at least make the site part of the Microsoft domain (especially for a Beta). – DWilliams Jul 16 '09 at 02:11
  • And I don't see any references on microsoft.com to the website either. But that said, the certificate seems to have been issued by Microsoft... If it is a legit service, someone in their marketing/hr/security/whatever department needs a kick in the butt. – Mark Henderson Jul 16 '09 at 02:15
  • Domain registered on 25/Apr/2008 LINK. Certificate made on 12/3/09. Also found a MSDN blog pointing at it too. Seems like a legit service. But yes, it is agreed that someone needs a good kicking. =) – Qwerty Jul 16 '09 at 02:23
  • I'm not %100 sure about this - just encountered it. I did use it. Perhaps this was foolish... – chickeninabiscuit Jul 16 '09 at 03:38
  • You mean your test account created just for the purposes of this test and which can be deleted afterwards, like they suggest? Or were you planning to sit there and feed it with your domain admin credentials and then somehow make that their fault? – Rob Moir Jul 17 '09 at 07:53
  • Geeze, no need to be nasty. I can guarantee you that hundreds of gulliable end users won't read that. They will be having trouble accessing their exchange for whatever reason, and their sysadmins won't be helpful so they will google for the problem, find that site, and go "Oh Goodie" and because they're non-technical they'll just dive straight into it. Asking for trouble, especially if the website was non-legit. – Mark Henderson Jul 17 '09 at 10:01
1

I would rather use the tools that already exist on my box.

E.g.: Testing with Powershell or Exchange Best Practices Analyzer

Qwerty
  • 1,504
1

A WHOIS search seems to indicate that the domain name belongs to Microsoft and is registered through "Corporate Domains, Inc." The DNS hosting is done by Microsoft servers, as well.

So, you may have dodged a bullet, but maybe you should have someone you trust change your administrative passwords and forget to tell you what they are. :)

I don't understand why a company would put an official-seeming site at a completely unrelated domain. I remember Network Solutions and maybe Register.com used to register domains like "domain-renewal.com" and they'd try to have you conduct business there. Luckily they stopped doing that.

mhud
  • 531
0

From an nslookup I get:

Name:
testexchangeconnectivity.microsoft.akadns.net

I don't care that it does have the word "microsoft" in there, it just doesn't look like a Microsoft site to me.

John Gardeniers
  • 27,558